Exponent CMS 2.3.9 i wcześniejsze vulnerabilities
8 known CVE vulnerabilities in Exponent CMS 2.3.9 i wcześniejsze, translated and rated.
- CVE-2016-9087Critical
Exponent CMS versions 2.3.9 and earlier have an SQL injection vulnerability in filedownloadController.php. This allows remote attackers to execute arbitrary SQL commands via the fileid parameter.
- CVE-2016-9020Critical
CVE-2016-9020 is a SQL injection vulnerability in helpController.php in Exponent CMS version 2.3.9 and earlier. It allows remote attackers to execute arbitrary SQL commands via the version parameter.
- CVE-2016-9019Critical
CVE-2016-9019 is an SQL injection vulnerability in the activate_address function in addressController.php in Exponent CMS version 2.3.9 and earlier. It allows remote attackers to execute arbitrary SQL commands via the is_what parameter.
- CVE-2016-7789Critical
CVE-2016-7789 is a SQL injection vulnerability in expConfig.php in Exponent CMS version 2.3.9 and earlier. It allows remote attackers to execute arbitrary SQL commands via the apikey parameter.
- CVE-2016-7788Critical
Exponent CMS versions 2.3.9 and earlier have an SQL injection vulnerability in framework/modules/users/models/user.php that allows remote attackers to execute arbitrary SQL commands via the username parameter.
- CVE-2016-7784Critical
CVE-2016-7784 is an SQL injection vulnerability in the getSection function in expRouter.php in Exponent CMS version 2.3.9 and earlier. It allows remote attackers to execute arbitrary SQL commands via the section parameter.
- CVE-2016-7782Critical
CVE-2016-7782 is an SQL injection vulnerability in expConfig.php in Exponent CMS version 2.3.9 and earlier. It allows remote attackers to execute arbitrary SQL commands via the src parameter.
- CVE-2016-7781Critical
Exponent CMS versions 2.3.9 and earlier have an SQL injection vulnerability in blogController.php. This allows remote attackers to execute arbitrary SQL commands via the 'author' parameter.